mail-recipient-probe Free

Deliveries to mailboxes that do not exist, domain after domain — directory harvesting, collecting valid addresses to spam

Category

mail

Threshold

3/24h, 5/7d

Ban policy

attack

Report

mail-spam

Parsers

inline

Why it is written this way

The rule file View raw

# Walking mailboxes that do not exist, domain after domain: "User unknown
# in virtual mailbox table" for contact@ on four different customer sites
# in a day, always the same envelope sender (2026-09-08). What convicts
# is the BREADTH again, never the number of tries: measured the same day
# on one machine, 1 480 such refusals, and of the 312 addresses that
# collected them, 291 asked for exactly ONE mailbox — a mistyped address,
# a bounce, a mailing list with a dead entry. The heaviest by volume were
# Yahoo's own servers retrying a single dead mailbox seventeen times: a
# count would have banned them, distinct recipients do not.
rule: mail-recipient-probe
description: "Deliveries to mailboxes that do not exist, domain after domain — directory harvesting, collecting valid addresses to spam"
about:
  purpose: >-
    Catch someone walking your mailboxes to learn which ones exist.
  blocks: >-
    Refusals for three DISTINCT recipients that do not exist, in a day.
  applies_to: >-
    Any machine running Postfix with virtual mailboxes.
  requires:
    - >-
      The mail log, declared as `log: mail` — /var/log/mail.log on Debian and Ubuntu, /var/log/maillog on RHEL and its family.
    - >-
      The mail ports declared beside that log, so a ban closes the mail and leaves the websites alone.
  beware:
    - >-
      Measured on one machine in a day: 1 480 such refusals, and of the 312 addresses collecting them, 291 asked for exactly ONE mailbox — a mistyped address, a bounce, a mailing list with a dead entry. The heaviest by volume were Yahoo's own servers retrying a single dead mailbox seventeen times. Counting refusals would have banned them; counting distinct recipients does not.
category: mail
log: mail
time_field: time
time_format: syslog
parsers:
  - regex: '^(?P<time>[A-Z][a-z]{2} [ 0-9]\d \d{2}:\d{2}:\d{2}) \S+ postfix/smtpd\[\d+\]: NOQUEUE: reject: RCPT from \S+\[(?P<ip>[0-9a-fA-F.:]+)\]: 550 5\.1\.1 <(?P<rcpt>[^>]*)>: Recipient address rejected'
    prefilter: "Recipient address rejected"
distinct: rcpt
threshold: [3/24h, 5/7d]
ban: attack
report: mail-spam